CVEFinder.io

CVE-2026-28732

🔶 medium
🔍 Scan for this CVE
Summary

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597

CVSS Score
4.3
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-18
First Seen: 2026-05-19
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.3% of all 349,476 vulnerabilities in our database.

#330,827
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 18, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
mr_anksec
SSVC data provided by CISA
Last Modified 2026-05-19
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE IDs (Weakness Types)
CWE-863

📦 Affected Products 3

Vendor Product Status Affected Versions
mattermost mattermost_server Affected
> 10.11.0 < 10.11.14
mattermost mattermost_server Affected
> 11.4.0 < 11.4.4
mattermost mattermost_server Affected
> 11.5.0 < 11.5.2

🔗 References 1

https://mattermost.com/security-updates
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-10527 🔶 medium 6.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a ... 2026-08-17
CVE-2026-15754 🔶 medium 4.2 0.2 Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate ... 2026-08-17
CVE-2026-16044 🔶 medium 5.4 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privile... 2026-08-17
CVE-2026-16045 🔶 medium 4.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and person... 2026-08-17
CVE-2026-16046 🔶 medium 4.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for f... 2026-08-17
CVE-2026-16047 🔶 medium 4.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access... 2026-08-17
These CVEs affect the same products